SQL Injection Payload Impact: UNION vs DROP TABLE

312-50v13 By islever Editorial Last updated

SQL Injection

Short answer

D This payload manipulates the WHERE clause and executes a DROP TABLE statement, causing permanent data loss.

Question

You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some suspicious activities and suspect an attacker is using SQL injection techniques. The attacker is believed to use different forms of payloads in his SQL queries. In the case of a successful SQL injection attack, which of the following payloads would have the most significant impact?
  1. UNION SELECT NULL, NULL, NULL -- : This payload manipulates the UNION SQL operator, enabling the attacker to retrieve data from different database tables
  2. ' OR username LIKE '%': This payload uses the LIKE operator to search for a specific pattern in a column
  3. ' OR '1'='l: This payload manipulates the WHERE clause of an SQL statement, allowing the attacker to view unauthorized data
  4. ' OR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE clause with a destructive action, causing data loss Correct Answer

Key Takeaways

The core concept is assessing attack impact; the trap is prioritizing stealthy data theft over immediate catastrophic destruction.

This question evaluates the severity of different SQL injection payloads, contrasting data exfiltration with destructive commands. The correct answer identifies the payload causing permanent data loss as having the most significant impact.

Common mistake: Candidates often select Option A (UNION SELECT) because it represents a common method for data exfiltration, failing to recognize that destructive actions like DROP TABLE have a higher severity rating due to data loss.

Expert Analysis

Why the Answer Is Correct

Option D is the correct answer because it combines authentication bypass with a destructive command (DROP TABLE). In security impact assessments, the availability and integrity of data are critical; deleting an entire table causes irreversible damage, which is more severe than merely viewing unauthorized records. As NikoTomas noted, "DROP table... deletes entire database," highlighting the permanence of this action.

Why the Other Options Are Wrong

Option A uses UNION SELECT to extract data, which compromises confidentiality but does not destroy data. Option B attempts pattern matching but is less impactful than full extraction. Option C allows viewing unauthorized data via logical bypass, again affecting confidentiality without integrity loss. None of these options cause the permanent system degradation seen in Option D.

Community Comment Notes

The community consensus strongly favors Option D. Killwitch explained that Option D is the most destructive because it results in "permanent data loss by deleting an entire database table." This aligns with exam logic where 'most significant impact' implies the highest level of harm, typically defined by data loss or system compromise rather than just information disclosure.

Exam Strategy

When asked about 'significant impact' or 'severity,' prioritize Integrity and Availability impacts (data loss, system crash) over Confidentiality impacts (data theft). Always look for destructive keywords like DROP, DELETE, or TRUNCATE when evaluating SQL injection outcomes.

Frequently Asked Questions

Why isn't UNION SELECT the most significant?

UNION SELECT only extracts data (Confidentiality), whereas DROP TABLE destroys data (Integrity/Availability). Destruction is considered a higher impact.

What defines 'significant impact' in CEH exams?

It usually refers to the worst-case scenario outcome, such as total data loss, system takeover, or denial of service, rather than just information gathering.

More 312-50v13 FAQ →

Community Votes

D
75%
A
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. NikoTomas 👍 2 Answered D
    which of the following payloads would have the most significant impact? --> D) DROP table, which deletes entire database, so it makes the most significant impact.
  2. Gibsomd 👍 1 Answered A
    This payload leverages the UNION SQL operator to combine the results of one query with another. Attackers use UNION-based SQL Injection to extract data from other tables within the database by ensuring that the number of selected columns matches the original query.
  3. killwitch 👍 1 Answered D
    Among the given options, the most destructive SQL injection payload is option D, as it not only bypasses authentication but also executes a DROP TABLE statement, which results in permanent data loss by deleting an entire database table.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide